Aug 9 01:09:05 prd-ubuntu2204-docker-4c-4g-3656 passwd[688]: password for 'ubuntu' changed by 'root' Aug 9 01:09:05 prd-ubuntu2204-docker-4c-4g-3656 systemd-logind[720]: New seat seat0. Aug 9 01:09:05 prd-ubuntu2204-docker-4c-4g-3656 sshd[753]: Server listening on 0.0.0.0 port 22. Aug 9 01:09:05 prd-ubuntu2204-docker-4c-4g-3656 sshd[753]: Server listening on :: port 22. Aug 9 01:09:05 prd-ubuntu2204-docker-4c-4g-3656 systemd-logind[720]: Watching system buttons on /dev/input/event0 (Power Button) Aug 9 01:09:05 prd-ubuntu2204-docker-4c-4g-3656 systemd-logind[720]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard) Aug 9 01:09:09 prd-ubuntu2204-docker-4c-4g-3656 sshd[962]: error: kex_exchange_identification: Connection closed by remote host Aug 9 01:09:09 prd-ubuntu2204-docker-4c-4g-3656 sshd[962]: Connection closed by 10.30.168.15 port 54966 Aug 9 01:09:16 prd-ubuntu2204-docker-4c-4g-3656 sshd[970]: Invalid user jenkins from 10.30.168.15 port 54972 Aug 9 01:09:16 prd-ubuntu2204-docker-4c-4g-3656 sshd[970]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Aug 9 01:09:16 prd-ubuntu2204-docker-4c-4g-3656 sshd[970]: Received disconnect from 10.30.168.15 port 54972:11: Closed due to user request. [preauth] Aug 9 01:09:16 prd-ubuntu2204-docker-4c-4g-3656 sshd[970]: Disconnected from invalid user jenkins 10.30.168.15 port 54972 [preauth] Aug 9 01:09:19 prd-ubuntu2204-docker-4c-4g-3656 sshd[972]: Invalid user jenkins from 10.30.168.15 port 54976 Aug 9 01:09:19 prd-ubuntu2204-docker-4c-4g-3656 sshd[972]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Aug 9 01:09:19 prd-ubuntu2204-docker-4c-4g-3656 sshd[972]: Received disconnect from 10.30.168.15 port 54976:11: Closed due to user request. [preauth] Aug 9 01:09:19 prd-ubuntu2204-docker-4c-4g-3656 sshd[972]: Disconnected from invalid user jenkins 10.30.168.15 port 54976 [preauth] Aug 9 01:09:22 prd-ubuntu2204-docker-4c-4g-3656 sshd[974]: Invalid user jenkins from 10.30.168.15 port 54978 Aug 9 01:09:22 prd-ubuntu2204-docker-4c-4g-3656 sshd[974]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Aug 9 01:09:22 prd-ubuntu2204-docker-4c-4g-3656 sshd[974]: Received disconnect from 10.30.168.15 port 54978:11: Closed due to user request. [preauth] Aug 9 01:09:22 prd-ubuntu2204-docker-4c-4g-3656 sshd[974]: Disconnected from invalid user jenkins 10.30.168.15 port 54978 [preauth] Aug 9 01:09:26 prd-ubuntu2204-docker-4c-4g-3656 sshd[1208]: Invalid user jenkins from 10.30.168.15 port 54982 Aug 9 01:09:26 prd-ubuntu2204-docker-4c-4g-3656 sshd[1208]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Aug 9 01:09:26 prd-ubuntu2204-docker-4c-4g-3656 sshd[1208]: Received disconnect from 10.30.168.15 port 54982:11: Closed due to user request. [preauth] Aug 9 01:09:26 prd-ubuntu2204-docker-4c-4g-3656 sshd[1208]: Disconnected from invalid user jenkins 10.30.168.15 port 54982 [preauth] Aug 9 01:09:29 prd-ubuntu2204-docker-4c-4g-3656 sshd[1317]: Invalid user jenkins from 10.30.168.15 port 54986 Aug 9 01:09:29 prd-ubuntu2204-docker-4c-4g-3656 sshd[1317]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Aug 9 01:09:29 prd-ubuntu2204-docker-4c-4g-3656 sshd[1317]: Received disconnect from 10.30.168.15 port 54986:11: Closed due to user request. [preauth] Aug 9 01:09:29 prd-ubuntu2204-docker-4c-4g-3656 sshd[1317]: Disconnected from invalid user jenkins 10.30.168.15 port 54986 [preauth] Aug 9 01:09:31 prd-ubuntu2204-docker-4c-4g-3656 useradd[1334]: new group: name=jenkins, GID=1001 Aug 9 01:09:31 prd-ubuntu2204-docker-4c-4g-3656 useradd[1334]: new user: name=jenkins, UID=1001, GID=1001, home=/home/jenkins, shell=/bin/bash, from=none Aug 9 01:09:31 prd-ubuntu2204-docker-4c-4g-3656 usermod[1343]: add 'jenkins' to group 'docker' Aug 9 01:09:31 prd-ubuntu2204-docker-4c-4g-3656 usermod[1343]: add 'jenkins' to shadow group 'docker' Aug 9 01:09:32 prd-ubuntu2204-docker-4c-4g-3656 sshd[1377]: Accepted publickey for jenkins from 10.30.168.15 port 54990 ssh2: RSA SHA256:BBsm4mRgG5V0fGum4Y1Rmy/vs16stdRVhwvexlLUhUs Aug 9 01:09:32 prd-ubuntu2204-docker-4c-4g-3656 sshd[1377]: pam_unix(sshd:session): session opened for user jenkins(uid=1001) by (uid=0) Aug 9 01:09:32 prd-ubuntu2204-docker-4c-4g-3656 systemd-logind[720]: New session 1 of user jenkins. Aug 9 01:09:32 prd-ubuntu2204-docker-4c-4g-3656 systemd: pam_unix(systemd-user:session): session opened for user jenkins(uid=1001) by (uid=0) Aug 9 01:10:02 prd-ubuntu2204-docker-4c-4g-3656 CRON[1833]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:10:02 prd-ubuntu2204-docker-4c-4g-3656 CRON[1833]: pam_unix(cron:session): session closed for user root Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/bin/java java /usr/lib/jvm/java-21-openjdk-amd64/bin/java 1 Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session closed for user root Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-21-openjdk-amd64/bin/javac 1 Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session closed for user root Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/lib/jvm/java-openjdk java_sdk_openjdk /usr/lib/jvm/java-21-openjdk-amd64 1 Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session closed for user root Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --set java /usr/lib/jvm/java-21-openjdk-amd64/bin/java Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session closed for user root Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --set javac /usr/lib/jvm/java-21-openjdk-amd64/bin/javac Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session closed for user root Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --set java_sdk_openjdk /usr/lib/jvm/java-21-openjdk-amd64 Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Aug 9 01:11:00 prd-ubuntu2204-docker-4c-4g-3656 sudo: pam_unix(sudo:session): session closed for user root Aug 9 01:11:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2098]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:11:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2098]: pam_unix(cron:session): session closed for user root Aug 9 01:12:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2127]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:12:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2127]: pam_unix(cron:session): session closed for user root Aug 9 01:13:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2130]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:13:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2130]: pam_unix(cron:session): session closed for user root Aug 9 01:14:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2136]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:14:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2136]: pam_unix(cron:session): session closed for user root Aug 9 01:15:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2452]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:15:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2452]: pam_unix(cron:session): session closed for user root Aug 9 01:16:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2457]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:16:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2457]: pam_unix(cron:session): session closed for user root Aug 9 01:17:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2464]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:17:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2465]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:17:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2465]: pam_unix(cron:session): session closed for user root Aug 9 01:17:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2464]: pam_unix(cron:session): session closed for user root Aug 9 01:18:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2473]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:18:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2473]: pam_unix(cron:session): session closed for user root Aug 9 01:19:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2476]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:19:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2476]: pam_unix(cron:session): session closed for user root Aug 9 01:20:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2483]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:20:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2483]: pam_unix(cron:session): session closed for user root Aug 9 01:21:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2488]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:21:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2488]: pam_unix(cron:session): session closed for user root Aug 9 01:22:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2493]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:22:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2493]: pam_unix(cron:session): session closed for user root Aug 9 01:23:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2496]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:23:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2496]: pam_unix(cron:session): session closed for user root Aug 9 01:24:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2502]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:24:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2502]: pam_unix(cron:session): session closed for user root Aug 9 01:25:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2507]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:25:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2507]: pam_unix(cron:session): session closed for user root Aug 9 01:26:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2512]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:26:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2512]: pam_unix(cron:session): session closed for user root Aug 9 01:27:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2515]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:27:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2515]: pam_unix(cron:session): session closed for user root Aug 9 01:28:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2519]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:28:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2519]: pam_unix(cron:session): session closed for user root Aug 9 01:29:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2635]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:29:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[2635]: pam_unix(cron:session): session closed for user root Aug 9 01:30:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[3349]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:30:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[3349]: pam_unix(cron:session): session closed for user root Aug 9 01:31:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[4127]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:31:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[4127]: pam_unix(cron:session): session closed for user root Aug 9 01:32:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[4856]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:32:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[4856]: pam_unix(cron:session): session closed for user root Aug 9 01:33:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[5678]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:33:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[5678]: pam_unix(cron:session): session closed for user root Aug 9 01:34:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[6409]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:34:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[6409]: pam_unix(cron:session): session closed for user root Aug 9 01:35:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[7387]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:35:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[7387]: pam_unix(cron:session): session closed for user root Aug 9 01:36:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[8332]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:36:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[8332]: pam_unix(cron:session): session closed for user root Aug 9 01:37:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[9088]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:37:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[9088]: pam_unix(cron:session): session closed for user root Aug 9 01:38:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[9738]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:38:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[9738]: pam_unix(cron:session): session closed for user root Aug 9 01:39:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[10305]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:39:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[10305]: pam_unix(cron:session): session closed for user root Aug 9 01:40:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[10929]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:40:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[10929]: pam_unix(cron:session): session closed for user root Aug 9 01:41:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[11714]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:41:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[11714]: pam_unix(cron:session): session closed for user root Aug 9 01:42:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[12481]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:42:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[12481]: pam_unix(cron:session): session closed for user root Aug 9 01:43:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[13137]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:43:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[13137]: pam_unix(cron:session): session closed for user root Aug 9 01:44:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[14382]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:44:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[14382]: pam_unix(cron:session): session closed for user root Aug 9 01:45:02 prd-ubuntu2204-docker-4c-4g-3656 CRON[15458]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:45:02 prd-ubuntu2204-docker-4c-4g-3656 CRON[15458]: pam_unix(cron:session): session closed for user root Aug 9 01:46:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[16108]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:46:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[16108]: pam_unix(cron:session): session closed for user root Aug 9 01:47:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17427]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:47:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17427]: pam_unix(cron:session): session closed for user root Aug 9 01:48:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17436]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:48:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17436]: pam_unix(cron:session): session closed for user root Aug 9 01:49:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17439]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:49:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17439]: pam_unix(cron:session): session closed for user root Aug 9 01:50:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17447]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:50:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17447]: pam_unix(cron:session): session closed for user root Aug 9 01:51:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17450]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:51:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17450]: pam_unix(cron:session): session closed for user root Aug 9 01:52:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17454]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:52:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17454]: pam_unix(cron:session): session closed for user root Aug 9 01:53:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17469]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Aug 9 01:53:01 prd-ubuntu2204-docker-4c-4g-3656 CRON[17469]: pam_unix(cron:session): session closed for user root Aug 9 01:53:29 prd-ubuntu2204-docker-4c-4g-3656 sudo: jenkins : PWD=/w/workspace/yangtools-maven-merge-master ; USER=root ; COMMAND=/usr/bin/cp /var/log/auth.log /tmp